California Data Privacy Claims: Nationwide Impact of New Legislation

Background: In recent years, thousands of businesses have received demands alleging that common website tools—including cookies, pixels, and chatbots—constitute illegal wiretapping or use of “pen registers.” The statutes prohibiting these practices predate the website technologies underlying these claims.

New Legislation: In response to the volume of threatened claims, the California legislature unanimously passed SB 690, which Governor Newsom recently signed into law. Among other changes, SB 690 bars individuals from suing private businesses under the California Invasion of Privacy Act (“CIPA”) § 638.51—the pen register and trap-and-trace provision—for conduct involving a website, online application, or mobile application. Only the California Attorney General may bring such claims. Most importantly for business owners, this change applies retroactively to pending claims in lawsuits filed on or after January 1, 2025 (meaning that most demand letters and lawsuits relating to such claims sent over the past two years are of no force or effect).

Exemption: It is important to note that the law does not legalize tracking practices and that private wiretapping claims involving interactive chats, session replays, third-party pixels, and similar technologies remain viable. Claimants and plaintiffs’ attorneys will likely pursue these theories as alternatives to pen-register claims.

What You Can Do: If you receive a CIPA demand letter, send it to us promptly. Pen register-only claims may now be subject to dismissal and should not be settled at their former value, but wiretapping allegations still require a full defense. Businesses with California-facing websites or apps should maintain their compliance programs by inventorying tracking technologies; ensuring cookie banners obtain consent before tracking begins; contractually limiting vendors’ use of collected data; providing notice and obtaining consent for chat and session-replay tools; keeping privacy policies current; and confirming insurance coverage for statutory privacy claims.

Contact Us: Our Technology Transactions, Privacy, and Cybersecurity Team remains committed to helping clients understand and comply with continuously evolving data privacy laws and regulations. If you have any questions about this statute, your company’s data privacy practices, or website privacy policies, please contact Hal Ostrow at Rhoades McKee.